Every CVE Search/ Get API key

CVE-2021-3563

Openstack Keystone Incorrect Authorization vulnerability

7.4 HighFix available

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
None

Exploit likelihood

1.86%Up 0.9 points since Aug 27, 2022
90%50%10%1%

What each source reports

NVD Score used 7.4

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Record
CVE-2021-3563
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
CVE List No score

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Record
CVE-2021-3563
Weakness
CWE-863
Updated
2026-11-02
EUVDEUVD-2022-6535 No score

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Record
EUVD-2022-6535
Updated
2026-11-03
GitHub AdvisoriesGHSA-cc99-whm5-mmq3 9.1

Openstack Keystone Incorrect Authorization vulnerability

A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is available.

Record
GHSA-cc99-whm5-mmq3
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
OSV 7.4

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Record
CVE-2021-3563
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-3563 7.4

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Record
DEBIAN-CVE-2021-3563
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
Show 4 moreShow less
OSVGHSA-cc99-whm5-mmq3 9.1

Openstack Keystone Incorrect Authorization vulnerability

A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is available.

Record
GHSA-cc99-whm5-mmq3
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Weakness
CWE-863
Updated
2026-11-02
OSVPYSEC-2026-370 9.1

Openstack Keystone Incorrect Authorization vulnerability

A flaw was found in openstack-keystone, only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity. A patch is available.

Record
PYSEC-2026-370
CVSS 3.1
9.1 CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2021-3563 7.4

A flaw was found in openstack-keystone. Only the first 72 characters of an application secret are verified allowing attackers bypass some password complexity which administrators may be counting on. The highest threat from this vulnerability is to data confidentiality and integrity.

Record
UBUNTU-CVE-2021-3563
CVSS 3.1
7.4 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Updated
2026-11-02
OSVUSN-7926-1 No score

keystone vulnerabilities

Kay discovered that OpenStack Keystone incorrectly handled the ec2tokens and s3tokens APIs. A remote attacker could possibly use this issue to obtain unauthorized access and escalate privileges. (CVE-2025-65073)

It was discovered that OpenStack Keystone only validated the first 72 bytes of an application secret. An attacker could possibly use this issue to bypass password complexity. (CVE-2021-3563)

It was discovered that OpenStack Keystone had a time lag before a token should be revoked by the security policy. A remote administrator could use this issue to maintain access for longer than expected. (CVE-2022-2447)

Record
USN-7926-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
keystone
PyPI
 through 21.0.0 None known
keystone
Debian:12
 All versions, plus listed versions
2:22.0.0-22:22.0.2-0+deb12u12:22.0.2-0+deb12u22:22.0.2-0+deb12u32:22.0.2-0+deb12u4
Show 45 moreShow less
2:22.0.2-0+deb12u52:22.0.2-0+deb12u62:23.0.0-12:23.0.0-22:23.0.0-32:23.0.0-42:23.0.0-52:23.0.0-62:23.0.0~rc1-12:24.0.0-12:24.0.0-22:24.0.0-32:24.0.0~rc1-12:25.0.0-12:25.0.0-22:25.0.0-32:26.0.0-12:26.0.0-22:26.0.0-32:26.0.0-42:26.0.0~rc1-12:26.0.0~rc1-22:27.0.0-12:27.0.0-22:27.0.0-32:27.0.0~rc1-12:27.0.0~rc1-22:28.0.0-12:28.0.0-22:28.0.0-32:28.0.0-42:28.0.0-52:28.0.0-62:28.0.0~rc1-12:28.0.0~rc1-22:28.0.0~rc1-42:29.0.0-12:29.0.0-22:29.0.0-32:29.0.0~rc1-12:29.0.0~rc1-22:29.0.1-12:29.0.1-22:29.0.2-12:29.0.2-2
 None known
keystone
Debian:13
 before 2:23.0.0-3
2:23.0.0-3
keystone
Debian:14
 before 2:23.0.0-3
2:23.0.0-3
keystone
Debian:10
From an advisory covering 2 CVEs
 before 2:14.2.0-0+deb10u2, plus listed versions
2:14.0.1-22:14.2.0-0+deb10u1
2:14.2.0-0+deb10u2
keystone
PyPI
 through 21.0.0, plus listed versions
12.0.212.0.313.0.213.0.313.0.4
Show 28 moreShow less
14.0.014.0.114.1.014.2.015.0.015.0.0.0rc115.0.0.0rc215.0.116.0.016.0.0.0rc116.0.0.0rc216.0.116.0.217.0.017.0.0.0rc117.0.0.0rc217.0.118.0.018.0.0.0rc118.1.019.0.019.0.0.0rc119.0.0.0rc219.0.120.0.020.0.0.0rc120.0.121.0.0.0rc1
 None known
keystone
Ubuntu:Pro:16.04:LTS
 All versions, plus listed versions
2:8.0.0-0ubuntu12:9.0.0~b1-0ubuntu12:9.0.0~b2-0ubuntu12:9.0.0~b3-0ubuntu12:9.0.0~rc1-0ubuntu1
Show 11 moreShow less
2:9.0.0-0ubuntu12:9.0.2-0ubuntu12:9.0.2-0ubuntu22:9.1.0-0ubuntu12:9.2.0-0ubuntu12:9.3.0-0ubuntu12:9.3.0-0ubuntu22:9.3.0-0ubuntu32:9.3.0-0ubuntu3.12:9.3.0-0ubuntu3.22:9.3.0-0ubuntu3.2+esm2
 None known
keystone
Ubuntu:Pro:18.04:LTS
 All versions, plus listed versions
2:12.0.0-0ubuntu12:13.0.0~b1-0ubuntu12:13.0.0~b2-0ubuntu12:13.0.0~b3-0ubuntu12:13.0.0~rc1-0ubuntu1
Show 7 moreShow less
2:13.0.0~rc2-0ubuntu12:13.0.0-0ubuntu12:13.0.1-0ubuntu12:13.0.2-0ubuntu12:13.0.2-0ubuntu32:13.0.4-0ubuntu12:13.0.4-0ubuntu1+esm1
 None known
keystone
Ubuntu:Pro:20.04:LTS
 All versions, plus listed versions
2:16.0.0-0ubuntu12:17.0.0~b1~git2019121613.db81fee63-0ubuntu12:17.0.0~b2~git2020020513.99733f172-0ubuntu12:17.0.0~b3~git2020032415.9f9040257-0ubuntu12:17.0.0~b3~git2020032415.9f9040257-0ubuntu2
Show 6 moreShow less
2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu12:17.0.0-0ubuntu0.20.04.12:17.0.1-0ubuntu12:17.0.1-0ubuntu22:17.0.1-0ubuntu2+esm12:17.0.1-0ubuntu2+esm2
 None known
keystone
Ubuntu:22.04:LTS
 before 2:21.0.1-0ubuntu2.1, plus listed versions
2:20.0.0-0ubuntu12:20.0.0+git2021120815.2ddf8f321-0ubuntu12:20.0.0+git2022011217.771c943ad-0ubuntu12:20.0.0+git2022030313.a3fc9e7c3-0ubuntu12:21.0.0-0ubuntu12:21.0.1-0ubuntu12:21.0.1-0ubuntu2
2:21.0.1-0ubuntu2.1
keystone
Ubuntu:22.04:LTS
From an advisory covering 3 CVEs
 before 2:21.0.1-0ubuntu2.1, plus listed versions
2:20.0.0-0ubuntu12:20.0.0+git2021120815.2ddf8f321-0ubuntu12:20.0.0+git2022011217.771c943ad-0ubuntu12:20.0.0+git2022030313.a3fc9e7c3-0ubuntu12:21.0.0-0ubuntu12:21.0.1-0ubuntu12:21.0.1-0ubuntu2
2:21.0.1-0ubuntu2.1

History

History
RecordedChangedSources
affected, facts
aliasesEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-3563 is a high vulnerability (CVSS 7.4) in Openstack Keystone, published August 26, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.86%, the 79th percentile. Fixed in keystone 2:23.0.0-3.

References

Show 13 moreShow less
This page doesn't list everything

Left out here: 5 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open